Skype Zeroday HTML/Javascript code injection

Noptri Public Security has released a working Skype zero day vulnerability with POC for Skype. Skype users need be aware of this vulnerability.

Vendor:

=======
Skype - http://www.skype.com/


Affected Product:
=================
Skype in version <= 5.5.0.113


Affected Platforms:
===================
Windows (XP, Vista, 7)

Problem Description:
====================
Skype suffers from a persistent code injection vulnerability due to a lack
of input validation and output sanitization of following profile entries:
    
    [+] home
    [+] office
    [+] mobile

POC of Skype 0day vulnerability

The following HTML codes can be used to trigger the described vulnerability:

--- SNIP ---

    [+] Home Phone Number:
    <b>INJECTION HERE</b>

    [+] Office Phone Number:
    <center><i>INJECTION HERE</i></center>
    
    [+] Mobile Phone Number:
    <a href="#">INJECTION HERE</a>

--- SNIP ---

By using this code An attacker could for example inject HTML/Javascript code. It has not been verified though, if it's possible to hijack cookies or to attack the underlying operating system. Attacker could give a try using extern .js files